6/2/2020 ase 9:18-cv-80176-BB Docume 7ByAn Senge Ped! SFE SPeDerekelOG/10/2020 Page 1 of 13 


AustLll 
Supreme Court of New South Wales - Court of Appeal 


Wright v Ryan & Anor [2005] NSWCA 368 (27 October 2005) 
CITATION: Wright v Ryan & Anor [2005] NSWCA 368 

FILE NUMBER(S): 

40819 of 2004 

HEARING DATE(S): 30 August 2005; 31 August 2005 
JUDGMENT DATE: 27/10/2005 

PARTIES: 

Craig Wright (Appellant) 

Michael Ryan (First Respondent) 

DeMorgan Information Security Systems Pty Ltd (Second Respondent) 
JUDGMENT OF: Handley JA Hodgson JA Hunt AJA 

LOWER COURT JURISDICTION: Supreme Court - Equity Division 
LOWER COURT FILE NUMBER(S): SC 4638 of 2003 

LOWER COURT JUDICIAL OFFICER: Gzell J 

COUNSEL: 

G K Burton SC (Appellant) 

Dr J G Renwick (First Respondent) 

Submitting appearance (Second Respondent) 

SOLICITORS: 

Michie Shehadie & Co (Appellant) 

McArdle Legal (First Respondent) 

Toomey Pegg Drevikovsky (Second Respondent) 
CATCHWORDS: 


APPEAL - fresh evidence - additional evidence - requirements for in appeal from conviction for contempt of 
Court 


EVIDENCE - circumstantial - repetitive conduct 


EVIDENCE - fresh evidence - additional evidence - requirements for in appeal from conviction for contempt of 
Court 


ND 
LEGISLATION CITED: 


www6.austlii.edu.au/cgi-bin/viewdoc/au/cases/nsw/NS WCA/2005/368 .html?stem=0&amp;synonyms=0é&amp;query="craig wright" 1/13 


6/220 ase 9:18-cv-80176-BB DocumeMtS7ByAn Sintered OFFA SBCDetkePO8/10/2020 Page 2 of 13 
Supreme Court Act 1970 


DECISION: 
Appeal dismissed with costs 
JUDGMENT: 
IN THE SUPREME COURT 
OF NEW SOUTH WALES 
COURT OF APPEAL 
CA 40819 of 2004 
HANDLEY JA 
HODGSON JA 
HUNT AJA 
27 OCTOBER 2005 
CRAIG WRIGHT v MICHAEL RYAN & ANOR 
CATCHWORDS 


APPEAL - fresh evidence — additional evidence — requirements for in appeal from conviction for contempt of 
Court 


EVIDENCE - circumstantial - repetitive conduct 


EVIDENCE - fresh evidence — additional evidence — requirements for in appeal from conviction for contempt of 
Court 


FACTS 


The Supreme Court found the appellant guilty of contempt of Court by breaching undertakings given to the 
Court involving the carrying on of business in competition with and approaching customers of the second 
respondent. The appellant argued that the undertakings were too ambiguous and uncertain to be enforced, that 
certain companies were not customers of the second respondent and that he had not breached the 
undertakings. The appellant also sought to adduce fresh evidence in the appeal. HELD: (1) The appellant had 
breached the undertakings given to the Court. Circumstantial evidence established repetitive and continuous 
conduct of a kind that excluded as unreasonable any explanation other than the carrying on of a business: 
Martin v Osborne [1936] HCA 23; (1936) 55 CLR 367, 375-6 and Hope v Bathurst City Council [1978] HCA 20; 
(1980) 140 CLR 1, 8-9; (2) Acceptance of a business proposition from one of the second respondent’s customers 
was sufficient to breach the undertaking not to approach the second respondent’s customers; (3) The reception 
of the fresh evidence in this appeal from a conviction for a criminal offence was governed by s 75A(8) of the 
Supreme Court Act, but semble it may be appropriate in such an appeal for the Court to apply the less stringent 
tests applicable in appeals to the Court of Criminal Appeal: Ratten v The Queen [1974] HCA 35; (1974) 131 CLR 
510 and Gallagher v The Queen [1986] HCA 26; (1986) 160 CLR 392 referred to; (4) The fresh evidence was not 
capable of giving rise to a reasonable doubt as to the appellant’s guilt. 





ORDERS 
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Appeal dismissed with costs. 


IN THE SUPREME COURT 
OF NEW SOUTH WALES 
COURT OF APPEAL 
CA 40819 of 2004 
HANDLEY JA 
HODGSON JA 
HUNT AJA 
27 OCTOBER 2005 
CRAIG WRIGHT v MICHAEL RYAN & ANOR 
Judgment 


1 HANDLEY JA: On 31 August 2004 Gzell J found the appellant guilty of contempt of Court by breaching 
undertakings given to the Court on 4 September 2003. The breaches involved carrying on business in 
competition with DeMorgan Information Security Systems Pty Ltd (the company) and directly or indirectly 
approaching “any company, business, entity or person who is or was, as at 8 August 2003 a customer of [the 
company]”. On 15 November Gzell J sentenced him to imprisonment for 28 days suspended on condition that he 
perform 250 hours of community service, and he was ordered to pay the costs of the proceedings. 


2 His appeal, which lay as of right under the Supreme Court Act s 101(3), relevantly asserted (grounds 1-10) that 
the undertakings were too ambiguous and uncertain to be enforced, and challenged the Judge’s findings that 
News Ltd, Australian Stock Exchange Ltd (ASX) and Rail Infrastructure Corporation (RIC) were customers of the 
company (ground 11) and that he had committed breaches of the undertakings (grounds 12-14). 


3 The appellant did not give evidence at his trial, but relied on an affidavit in the proceedings on sentence when 
he was cross-examined. The affidavit sought to challenge the Judge’s findings on guilt, and was successfully 
objected to on this ground. The Judge admitted the affidavit on a limited basis, as relevant to the appellant’s 
state of mind, and his cross-examination was limited on the same basis. 


4 The appeal was initially fixed for 19 May 2005 but the appellant sought, at a late stage, to rely on an affidavit, 
said to be fresh evidence of a highly technical nature, relating to an email which the Judge found he had sent to 
RIC at 11.23 am on 10 September 2003. The hearing was adjourned and Hodgson JA ordered the appellant to 
pay a lump sum for the costs of the respondent thrown away and he was directed to file any further evidence 
within 14 days. His affidavit of 9 June was filed a few days late. Directions had also been given for the filing of 
evidence by the respondent in answer, but not for the filing of evidence in reply. The appeal was later fixed for 30 
and 31 August. 


5 The respondent filed an affidavit by himself of 11 July and an affidavit by Mr Taylor from Charles Sturt University 
(CSV) of 13 July. 


6 The appellant filed a further affidavit dealing with technical issues relevant to the authenticity of the disputed 
email on 23 August, and on the morning of 30 August he sought to rely on yet another technical affidavit he had 
sworn that day that counsel for the respondent only received that morning. 
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7 The Court upheld the respondent’s objection to the affidavit of 30 August because of its late service and the 
prejudice to the respondent which would have necessitated a further adjournment. Counsel for the respondent 
also objected to the affidavit of 23 August but frankly conceded that he was in a position to deal with it in cross- 
examination and address. That affidavit contained what, in substance, was evidence in chief, which should have 
been included in an affidavit filed within the time fixed by Hodgson JA, but the Court decided not to reject it on 
procedural grounds. 


8 Mr Burton SC, appearing for the appellant, then sought an adjournment to enable the affidavit of 30 August to 
be read at the adjourned date but, following lengthy argument, this application was refused. During the argument 
it became clear that the affidavit of 30 August contained extensive material which properly formed part of the 
appellant’s case on the fresh evidence application and strictly did not arise in reply to the affidavits of Mr Ryan 
and Mr Taylor. This should have been included in an affidavit filed within the time fixed by Hodgson JA. The 
appellant had already received the indulgence of one adjournment based on the late filing and service of a 
technical affidavit shortly before the hearing date on 19 May and we considered that there was no proper basis 
for granting a further indulgence, particularly as the delay was not explained. 


9 The Court then heard the appellant’s application for leave to adduce further evidence in the appeal. This 
comprised his affidavits of 9 June and 23 August and certain exhibits, and possibly his affidavit of 14 October 
2004 filed in the sentence proceedings. 


10 The further evidence was essentially directed to an email apparently sent by the appellant to Mr David 
Spencer of RIC at 11.23 am on 10 September 2003 (the disputed email). The appellant did not give evidence at 
his trial, but the respondent tendered that part of his affidavit of 24 October 2003 (blue 113) where he denied 
sending that email. 


11 A copy of the disputed email was found on the hard drive of the appellant’s computer when an Anton Pillar 
order was executed at his home at Bagno near Mt White on 16 September 2003. The email purported to come 
from “Craig S Wright [cwrigh20@postoffice.csu.edu.au]”, and was sent to “Spencer, Dave; 
Wright_c@demorgan.com.au; Spencer, Dave”. It stated: 


“More details to follow (ie proposal) 

But to monitor patching etc and provide documents for updates etc for 3 linux check point hosts 
1. Patch info for systems and services. 

2. Emergency fix info. 

3. Support on updates inc procedures where necessary. 

4. Help with upgrades 

$450 per month ex GST ($150 per system) 

Regards 

Craig S Wright” 


12 The disputed email was received by RIC and at Mr Wright’s email address at the company. The Judge drew 

the inference that it was sent using Mr Wright’s email address to RIC and to his email address at the company 

and a copy was retained on his computer. This email formed the basis of the Anton Pillar order obtained by the 
plaintiffs which was executed on 16 September. The appellant in his affidavit of 14 October 2004 filed in the 
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proceedings on sentence again denied sending this email and gave reasons (blue 148) why he could not have 
offered to do the work at the rate quoted. He also said (blue 148-9): 


“| have recently obtained copies of the access logs from [CSU] on-line servers for my user account to access 
email (being the account from which it is alleged that | sent the email of 10 September 2003 to RIC). | have 
perused those logs and say that they disclose access to my account from proxy01.demorgan.com.au from 
August 2003 until November 2003. Proxy01.demorgan.com.au is a secured server inside [the company’s] 
network and to which | have not had access since my resignation on 10 August 2003. The logs disclose access 


to the account from IP address 144.135.38.125 which is my IP address at the farm at Port Macquarie ... The email 


dated 10 September 2003 ... was sent from IP address 144.135.104.27 which is not my IP address and which | 
have traced to an address in Melbourne.” 


13 In his affidavit of 9 June 2005 (orange 3) the appellant said that between 8 August and 23 October 2003 he 
maintained two email addresses, one at CSU and the other at the company, being his private address and his 
work address. He said that access to email at CSU was linked to the server email address my.csu.edu.au. To 
access that server and create a record in the logs at CSU (orange 4) he must log into CSU through the server 
auth.csu.edu.au, and access the system my.csu.edu.au by using cwrigh20 and a password. Once one had 
validly logged into CSU one can access and use one’s private email system and folders. 


14 He said that on 12 August he was excluded from the company’s premises and could no longer access its 
computer system. 


15 Before the trial he made inquiries at CSU for records of emails sent from his private email address, but was 
told there were no such records. A relevant subpoena was served on CSU without result. He continued his 
inquiries after the trial and in December 2004 obtained an extract copy of the logs from CSU for August to 
October 2003 comprising about 60,000 pages. 


16 He searched those logs which disclosed that secure CSU systems including my.scu.edu.au were accessed 
from proxy01.demorgan.com.au on 2549 occasions between August and October, an average of 21 times a day 
and he said that during that period he did not have access to nor did he access the address 
proxy01.demorgan.com.au. 


17 He said that the only persons who could have accessed that address were persons working within the 
premises of the company and that if such persons had been accessing his private address during that period 
“they could have created email messages purporting to come from me on that private address”. 


18 Mr Ryan said in his affidavit that the appellant still had in his possession after 12 August 2003 laptop and 
work-station computers owned by the company which were configured to access proxy01.demorgan.com.au 
(orange 9). This repeated a statement in his affidavit of 2 September 2003 (blue 7) which identified three of the 
computers by make and serial number and referred to another two not so identified. 


19 Mr Taylor said that the information sought by the appellant from CSU before and after the trial was freely 
available on its website with no requirement for a login or password, and the relevant webpage was not hard to 
locate from its home page. It could have been accessed by an appropriate search at any time during 2004. 


20 In his further affidavit of 23 August the appellant said: 


“I was never issued with a notebook/laptop at any time from [the company]. No computers owned by [the 
company] are, or have ever been, at my premises. The Dell host servers at my residence, which was searched 
pursuant to the Anton Pillar order on 16 September 2003, had different configurations from and were different 
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makes from those used at [the company]. Further the serial numbers on the hosts were not those of the [the 
company] host’s.” 


21 He said (orange 15-16) that proxy01.demorgan.com.au was the Host name of the unix server used by the 
company to access clients’ sites and the Internet. It had a fixed and permanent IP address 203.34.22.195. The 
source of an email is the IP address of the system used to construct it and it appears on the header. The IP 
address of the proxy server within the disputed email dated 10 September 2003 is 203.34.22.195 which was the 
source of the email internal to the company. 


22 The IP address 144.135.104.27 is a Telstra account in Melbourne and was not the sending IP of the disputed 
email. He said that it is an internal Telstra address and could not have been used to send the email as it is a 
secure dial in server at Telstra and does not run “a web client” (orange 16). The disputed email was sent from a 
web client. He said that the IP address for the Telstra server 144.135.104.27 listed in the header as the sending 
host of the email never had been his personal IP address. He had had the IP address 144.135.38.125 since 2002 
on the Telstra two-way satellite link from his home until he had it changed in August 2005. He had an IP address 
on the Telstra 2-way satellite link from his home (orange 16). He also had a wireless network there during 2003 
which the company was able to access (orange 17). 


23 On 10 September 2003 he made calls on his mobile phone at about the time the disputed email was sent 
which, according to his mobile phone accounts, were sent through Berowra (10.36 am), Cowan (11.09 am) and 
Berowra (11.48 am) (Sup blue 2/467). He said therefore he could not have been at home at Bagno or able to 
access his home computer at 11.23 on 10 September when the disputed email was sent (orange 17). He disputed 
parts of Mr Taylor’s affidavit. 


Admissibility of further evidence 


24 Section 75A(8) of the Supreme Court Act provides that on an appeal from a judgment after a trial or hearing 
on the merits “the Court shall not receive further evidence except on special grounds”. The Court has not 
attempted to exhaustively define what are special grounds for this purpose but the core concepts are those on 
which common law courts received fresh evidence on a motion for a new trial following the verdict of a jury. 
These were considered in Parsons v McCann [1954] HCA 70; (1954) 93 CLR 418, Wollongong Corporation v 
Cowan [1955] HCA 16; (1955) 93 CLR 435 and McDonald v McDonald [1965] HCA 45; (1965) 113 CLR 529. The 
evidence must be admissible and credible, and such that it could not have been discovered by the exercise of 
reasonable diligence before the trial. It must be of such probative value and significance that, taken with the 
evidence given at the trial, it will in all probability be decisive of the issues between the parties and result in a 
different verdict: McDonald v McDonald at 532 per Barwick Cu. 


25 Although this is an appeal from a conviction for a criminal offence the procedure is that which applies under 
the Supreme Court Act to appeals in civil cases. Under the Criminal Appeal Act 1912 the discovery of fresh 
evidence may lead the Court of Criminal Appeal to enter a verdict of acquittal in a sufficiently strong case, and in 
other cases to order a new trial. The focus in the Court of Criminal Appeal is on whether there has been a 
miscarriage of justice. As Barwick CJ said in Ratten v The Queen [1974] HCA 35; (1974) 181 CLR 510, 517: 


“Great latitude must of course be extended to an accused in determining what evidence by reasonable diligence 
in his own interest he could have had available at his trial, and it will probably be only in an exceptional case that 
evidence which was not actually available to him will be denied the quality of fresh evidence.” 


26 At 520 he discussed the way in which the Court of Criminal Appeal can use further evidence: 


“... if the new material, whether or not it is fresh evidence, convinces the court upon its own view of that material 
that there has been a miscarriage in the sense that a verdict of guilty could not be allowed to stand, the verdict 
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will be quashed without more. But if the new material does not so convince the court, and the only basis put 
forward for a new trial is the production of new material, no miscarriage will be found if that new material is not 
fresh evidence. But if there is fresh evidence which in the court’s view is properly capable of acceptance and 
likely to be accepted by a jury, and which is so cogent in the opinion of the court that, being believed, it is likely 
to produce a different verdict, a new trial will be ordered as a remedy for the miscarriage which has occurred 
because of the absence at the trial of the fresh evidence.” 


27 The High Court affirmed these principles in Gallagher v The Queen [1986] HCA 26; (1986) 160 CLR 392, subject 
to some adjustments. The Court held (399, 402) that there will be a miscarriage of justice where “there is a 
significant possibility that the jury, acting reasonably, would have acquitted the applicant of the charge if the new 
evidence had been before it in the trial”. The Court also referred (896, 401) to the judgment of Rich and Dixon JJ 
in Craig v The King [1933] HCA 41; (1933) 49 CLR 429, 439 where their Honours said of fresh evidence in criminal 
cases: 


“Such evidence should be calculated at least to remove the certainty of the prisoner’s guilt which the former 
evidence produced.” 


28 Gibbs CJ discussed the requirements for due diligence (396): 


“... the conviction will not be usually set aside if the evidence relied on could with reasonable diligence have 
been produced by the accused at the trial ... [but] this is not a universal and inflexible requirement: the strength 
of the fresh evidence may in some cases be such as to justify interference with the verdict, even though that 
evidence might have been discovered before the trial.” 


29 This Court has not decided whether the tests applied under s 75A(8) in civil cases apply to appeals from 
criminal convictions for contempt of court or whether the Court should adopt the less stringent tests applied in 
the Court of Criminal Appeal. This question was not fully argued and, without expressing any view on that 
question, we should apply the less stringent tests. 


30 It is strongly arguable that the appellant has not discharged the onus of establishing that CSU’s records of 
emails sent through its server could not have been discovered before the trial by the exercise of reasonable 
diligence. The affidavit evidence of Mr Taylor appears to establish that it would have been a simple matter to 
discover their existence by searching CSU’s home page on its website. 


31 The appellant was cross-examined but Mr Taylor was not. He lives at Bathurst and notice for him to attend for 
cross-examination was not given until a day or so before the hearing. 


32 Since | have reached the firm conclusion that the appellant has not discharged the onus of proving that the 
further evidence is credible and would probably have been decisive, | am content to base my decision on those 
grounds without expressing a final opinion on the question of due diligence. 


33 The case against the appellant was based on circumstantial and documentary evidence. This included emails 
recovered on the Anton Pillar raid, or produced by third parties on subpoena. The plaintiffs also tendered the 
appellant’s mobile phone records and parts of his affidavits of 11 September and 24 October 2003. Finally they 
tendered the security records of the ASX showing visits by the appellant to its premises on 4, 8, 9, 11, and 30 
September and 15 and 24 October 2003. 


34 There were emails to and from RIC on 9 (two), 10 (five), 11 (two) and 30 September and to News Ltd on 22 and 
23 October. The appellant’s mobile phone records disclosed calls to RIC on 8 (three), 9 (four), 10, 15, 16 (four), 17 
(two), 18 (five) and 29 September and 1, 2 (eight), 9 (three), 10, 14 (three), 20 (two) and 23 October. The appellant’s 
affidavit of 11 September disclosed a further telephone call to RIC on 5 September. 
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35 The records disclosed telephone calls to the ASX on 4 (two), 9, 11, 23, 26 and 29 September and 1 and 9 
October. There were also telephone calls to News Ltd on 15, 23, 24, 26 September and 1, 9 (four) and 23 
October, to the Human Rights and Equal Opportunity Commission on 18 October and four calls to Val Morgan on 
30 September. There were also emails to News Ltd on 22 and 23 October. 


36 These facts, other than the authenticity of the emails of 11.23 am [para 11] and 11.16 am to RIC on 10 
September 2003 (sup blue 2/354) were not in dispute. 


37 In his affidavit of 14 October 2004 the appellant explained the background to the email of 11.16 am (blue 148 
para 22), and denied sending the disputed email (para 23). In his affidavit of 9 June 2005 (orange 7) the appellant 
denied sending “emails” to RIC on 10 September 2003, and he repeated this denial in his affidavit of 23 August 
2005 (orange 18 para 14). The denial in the plural was said by Mr Burton to refer to the emails of 11.16 am and 
11.23 am, and not the earlier emails that day. 


38 Subject to the submissions on legal questions which will be considered later, the circumstantial case against 
the appellant was overwhelming, even if the disputed email or emails are ignored. The relevant principles are 
those stated in Martin v Osborne [1936] HCA 23; (1936) 55 CLR 367, 375-6 per Dixon J: 


“If an issue is to be proved by circumstantial evidence, facts subsidiary to or connected with the main fact must 
be established from which the conclusion follows as a rational inference ... The circumstances which may be 
taken into account in this process of reasoning include all facts and matters which ... make intelligible the course 
of conduct pursued ... the acts of a party are admissible against him whenever they form a component in a 
combination of circumstances which is unlikely to occur without the fact in issue also occurring. The repetition of 
acts or occurrences is often the very thing which makes it probable that they are accompanied by some further 
fact. The frequency with which a set of circumstances recurs or the regularity with which a course of conduct is 
pursued may exclude, as unreasonable, any other explanation or hypothesis than the truth of the fact to be 
proved.” 


39 It was not suggested that the further evidence actually established that the disputed emails were forged by 
the company. The submission was that they had not been sent by the appellant, but had been fabricated by an 
unknown person who was able to access the company’s computers as well as those of the appellant. Even if this 
had been established the conviction would probably not have been quashed having regard to the strength of the 
general circumstantial case. 


40 The disputed email was found on a computer at the appellant’s home during the Anton Pillar raid on 16 
September 2003 (blue 109). It was found on a temporary Internet file opened and viewed during the raid when a 
copy to self folder used to store email messages online was accessed (blue 107, 108, 109). It had not originated 
on that computer, but had been sent from a remote location. However its presence in a “copy to self” file 
supported an inference that it had been sent by the appellant. 


41 Mr Ryan said that a copy of the disputed email was received on the screen of his personal computer at the 
company’s premises (blue 51). After the appellant left the company Mr Ryan reprogrammed his computer to 
ensure that incoming emails directed to the appellant were sent to his computer (orange pp 8-9). 


42 The appellant said that after he left the company’s premises on 12 August 2003 he could no longer access its 
secured server as it was protected by a security system known as a firewall for which he needed a password, a 
user name and an access token. He said he had surrendered his token (orange 4). Mr Ryan said that an access 
token was not required for this purpose (T 109). 


43 The appellant said that he could not have sent the disputed email because he did not have access to 
computers which were configured to access proxy01.demorgan.com.au [para 18], but Mr Ryan said the appellant 
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retained five computers belonging to the company which had this capacity. The appellant denied this. The 
appellant also said that proxy01.demorgan.com.au could only have been accessed by persons working within 
the company’s premises (orange 6(20)) but Mr Ryan said it could have been accessed from any computer 
anywhere in the world with the appropriate configuration (orange 9(10)). 


44 The appellant said that a third party could have accessed his secure email address at CSU to create and 
send the disputed email. Such a person would have needed to use the appellant’s username and a password 
(orange 4(5)), or else to successfully hack into the system. It was not established that anyone at the company 
had the appellant’s password or that his system had been penetrated. 


45 The appellant established that during September 2003 secure accounts at CSU had been accessed through 
its secure server, server online, from proxy01.demorgan.com.au, another secure server (T 96) 58 times (exs C, D) 
and from the Telstra IP address 144.135.104.27 170 times. The former established very little because it was not 
known which secure accounts at CSU had been accessed and it was not established that the appellant’s 
account had ever been accessed through proxy01.demorgan.com.au. There are probably thousands of such 
accounts which can be accessed through CSU’s server online for the University, its staff, and the students (T 84, 
96), and the access obtained on the 58 occasions could have been to any account at CSU (T 96). 


46 The appellant said that the Telstra IP address 144.135.104.27 could not have been used to send the disputed 
email (orange 16). Mr Ryan said that it was an IP address allocated to Telstra under a portable allocation (T 98) for 
satellite usage (T 99). Authorised persons could use that IP address if they had access including portable access 
or could make use of satellite mechanisms (T 99). There was nothing on the copy search of 144.135.104.27 (ex E) 
to link that IP address to a satellite account or any particular satellite account (T 117). 


47 According to the appellant the disputed email was sourced from a proxy server within the company with the 
IP address 203.34.22.195 (orange 16). He said in his oral evidence that it did not originate from this IP address 
but from somewhere in the company’s network that was connected to that machine (T 127). He said that the IP 
address 144.135.104.27, the Telstra account, which was the “supposed” sending IP of the email, could not have 
been used to send it (orange 16). Mr Ryan said that it could have been sent through the Telstra IP address by any 
one who had appropriate access (T 99). 


48 Mr Ryan called a colleague, Mr Dornbrack, to view the disputed email on the server of his personal computer 
(black 81). Mr Dornbrack went to the “properties” of the email “to determine how the email got sent to us” (93). In 
computer language he cut and pasted the properties on to a notepad which produced a header text file which he 
saved (black 82). A hard copy became part of ex C (sup blue 1/168). Using the information on this document he 
prepared a flow chart which traced the movements of the email which also became part of ex C (1/167). Material 
is added to the header of an email at each stage as it moves from server to server (91). 


49 He said it was a web email “composed on the CSU post office” (83), the mail server at CSU (84). His flow 
chart traced the disputed email from the mail server postoffice.csu.edu.au to Telstra’s Bigpond satellite service 
144.135.104.27 (83) and also directly through an intermediate site at CSU to a computer designated firewall — 
ns.demorgan.com.au which was the company’s firewall or security gateway designed to prevent its network 
being attacked from the Internet (85-6). The disputed email then passed to the company’s proxy server 
proxy01.demorgan.com.au where email coming from the Internet is scanned (86) from where it passed to the 
company’s email server and then to Mr Ryan’s desktop PC (87). 


50 If Mr Dornbrack’s evidence was correct the disputed email originated from c_wright20@postoffice.csu.edu.au 
(92), a computer linked to CSU, and it was dispatched by the sender to the Telstra IP address and by different 

routes to the company and Mr Spencer. It did not originate at the company’s IP address 203.34.22.195 allocated 
to proxy01. That was its destination on this track. He said that the timing differences at the different stages within 
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the company’s network were normal because the clocks on different pieces of computer hardware drift (88-9, 
91). The appellant said in this Court when recalled that the company’s computers operated on synchronised time 
(T 128). This was not put to Mr Dornbrack during his cross-examination at the trial. 


51 The appellant said (orange 17-8) that if he had sent the disputed email it would have increased in size as it 
passed through each mail server until it reached the company. He said a comparison of the message source 
details for this email obtained from the company’s exchange server produced to the Court on 19 September 
2003 (orange 57-8) and the print out from the temporary Internet file downloaded from his computer during the 
Anton Pillar raid (blue 109) showed that its logical size had grown from 1687 to 4054. The appellant said that this 
indicated that it had originated at the company. The document at orange 57-8 contains more information about 
the source and movement of the email than the document produced by Mr Dornbrack (sup blue 1/168) already 
considered [para 50]. 


52 Mr Ryan said the document at orange 57 showed that the email did not originate from the company’s IP 
address 203.34.22.195 but came through cwright20@postoffice.csu.edu.au (T 115-6). It did not show where it 
actually originated but it did not originate from 203.34.22.195 because that is where it went (T 116). He said that 
the letters and figures “3f5e7d03” in the header sheets (orange 57-9) for the company’s exchange and mail 
servers constituted a unique message that indicated that the email was established by a computer outside the 
company (T 123). This was not denied by the appellant in his later evidence. Mr Ryan described how the 
documents at orange 57-9 were produced and agreed that data could be changed during this process (T 118). He 
did not prepare the documents himself. The appellant said that “it was a text edited record” and not a log and 
had no relevance (T 127). Mr Dornbrack probably prepared these documents [para 48] but he was not cross- 
examined at the trial to suggest that he had changed the data. 


53 In answer to a question from a member of the Court the appellant said (T 127) that “this”, the document at 
orange 57-8, showed that the disputed email “actually originated somewhere in their network. It originated within 
their network that connect to that machine (203.34.22.195)”. When asked by another member of the Court what 
there was within the document that showed that the disputed email originated in the company’s building (T 127) 
the appellant gave a long answer by instalments based on the earliest times and smallest size being recorded at 
the exchange server, increasing at the mail server, and again at the firewall (T 127-9). He said that the document 
did not contain all the necessary information (T 128, 129). The significance of the time sequences depended on 
his evidence that the company’s system was synchronised (T 128). This was contrary to the evidence given at the 
trial by Mr Dornbrack (black 88-9, 91). The appellant said that the email could have been sent by any of the 
machines in the company’s network (T 128(15), 129(50)). 


54 In his affidavit of 23 August the appellant said that the calls from his mobile phone on 10 September (sup blue 
1/132) at 11.09 am and 11.48 am were shown as sent from Cowan and Berowra respectively so that at the time the 
disputed email was sent he must have been in his car approximately 20 minutes away from his home and could 
not have sent it (orange 17). 


55 The mobile phone records for 16 September show that this inference cannot be drawn. Times on the copy of 
the disputed email found on the appellant’s hard drive (blue 109) showed that the raid was in progress at 11.47 
am on 16 September. The appellant said that at that time he was outside his home using his mobile telephone 
(orange 17). His mobile phone records (Sup blue 1/132) show that he made phone calls at 11.33 am, 11.46 am, and 
11.59 am. These too are shown to have been made from Berowra, as was one of those calls said to have been 
made by the appellant from his car 20 minutes drive from his home on 10 September. It is therefore clear that the 
mobile phone records for 10 September do not establish that the appellant was not at his home at 11.23 am when 
the disputed email was sent. 
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56 The relevant emails to and from Mr Spencer of RIC of 10 September appear to start with one from the 
appellant at 12.40 am, although the text is not in evidence (sup blue 2/355-6). This produced a reply from Mr 
Spencer at 8.41 (356) and a response from the appellant at 8.44 (855). He said that he was then at Vodafone 
Chatswood and followed up this last email with a phone call to Mr Spencer (blue 148(21)). 


57 The email at 11.16 am (354) was acknowledged by the appellant as genuine in his affidavit of 14 October 2004 
(blue 148(22)). It was sent seven minutes after the appellant is recorded as making a call on his mobile phone 
from Cowan at 11.09 am. The disputed email followed at 11.23 am. The subject of both was described as “Re: 
specs”. The next email from the appellant at 12.27 pm that day showed as its subject “RE: Review Document”. It 
was sent in response to an earlier email from Mr Spencer recorded there but not shown independently (852). This 
seems to have been a response to an email sent by the appellant to Mr Spencer the day before (359) which 
referred to servers and was headed “Review Document”. On 30 September Mr Spencer sent a memorandum to 
the appellant (Sup blue 2/318) which relevantly stated: 


“Thank you for submitting a quotation for block of security consultancy hours based around our current check 
point implementation. 


Unfortunately we will not be taking up your offer of services opting for a proposal supplied by another 
organisation.” 


58 This may have been a response to the disputed email (T 37). 


59 The disputed email was produced on subpoena by RIC along with the other emails passing between the 
appellant and Mr Spencer. It was apparently received without provoking any email response from Mr Spencer 
asking what it was all about. The parties were again in communication by email the following day (Sup blue 
2/325, 347). 


60 It would have been extremely difficult for an outsider to fabricate the disputed email containing the details it 
did [para 11]. Mr Spencer and the appellant communicated with each other many times on 9, 10 and 11 
September by email, telephone, and in person. Somehow this email managed to make sense and fit in with 
these other communications. The fabrication of such an email by an outsider without this being immediately 
detected by the recipient is glaringly improbable. A copy of the email reached the appellant. He replied to his 
emails without delay and if the disputed email had been sent to him by a third party he would have become 
aware of its existence almost immediately. 


61 The arguably fresh evidence of the email records from CSU is credible but completely neutral. It establishes 
that the company could have accessed the appellant’s email address at CSU in order to sent the disputed email, 
but does not prove that it did so or establish that as a matter of probability. This evidence leads nowhere. It is 
not capable of giving rise to a reasonable doubt about the appellant’s guilt and could not have produced a 
different result if it had been admitted at the trial. 


62 The other new evidence by the appellant relating to the disputed email was based on his interpretation and 
explanation of the header text file produced by Mr Dornbrack (sup blue 1/168) and the message source details for 
that email produced to the Court under notice to produce on 19 September 2003 (orange 57-8). These 
documents were in evidence or available at the trial and the affidavit and oral evidence given by the appellant 
could have been given at the trial, and is manifestly not fresh evidence. 


63 The probative force of the new evidence depends in large measure on the appellant’s credibility and reliability. 
His explanations and interpretations of these and related documents are contradicted at critical points, on which 
there is no independent evidence to support him. The appellant’s contradictory evidence about the email of 11.16 
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am on 10 September 2003 raises doubts about his credibility, as does his evidence based on the calls from his 
mobile phone that day. 


64 Even if the new evidence about the disputed email was truly fresh it has not been positively shown to be 
credible and the appellant has failed to establish that its reception at the trial would probably have produced a 
different result. The additional evidence should therefore be rejected and the appeal should be determined on 
the evidence before the trial Judge. 


65 The appellant’s challenges to the Judge’s findings of guilt can be grouped as follows: 
(i) The construction of the undertakings to the Court, and the plaintiffs conduct of the trial in relation thereto. 


(ii) The findings that the appellant was carrying on business in competition with the company and approaching its 
customers. 


(iii) The finding that News Ltd was a customer of the company. 


66 The undertakings are summarised in para 1. The appellant argued that they were too ambiguous to be 
enforced because they incorporated or arguably incorporated the definition of business and the covenant not to 
approach customers of the company contained in the shareholder’s agreement between the company, Mr and 
Mrs Wright, and Mr Ryan. The contractual definition of associates was incorporated in the undertakings but they 
were otherwise self-contained, clear and unambiguous. The Judge’s decision to that effect was correct. 


67 The appellant relied before us, as he had relied below, on the opening by counsel for the plaintiffs before Gzell 
J (black 3) where he said that the undertakings were based on the shareholder’s agreement and in the event of 
ambiguity the relevant factual matrix would include that agreement. This was not a concession that the 
undertakings incorporated other terms of the agreement or that they were ambiguous. Since the undertakings 
were clear and unambiguous the argument based on the opening of counsel for the plaintiffs is without 
substance. 


68 The appellant’s activities summarised above [paras 33-5] establish repetitive and continuous conduct of a 
kind which excludes as unreasonable any explanation other than the carrying on of a business: Martin v Osborne 
[1936] HCA 23; (1936) 55 CLR 367, 375-6 para 38, and Hope v Bathurst City Council [1978] HCA 20; (1980) 140 
CLR 1, 8-9. 


69 The same activities also establish a breach of the undertaking not to approach customers. The appellant 
submitted that this would only be breached if he initiated the approach. While accidental or casual contact in the 
street or at a social function would not be a breach without more the appellant’s activities proved in evidence 
went far beyond this. 


70 An approach to the appellant initiated by a customer would not permit him to respond by approaching that 
customer either then or later in the course of continuing the association. In my judgment the undertaking did not 
even permit him to respond positively to a business approach from such a customer as that itself would be an 
approach within the meaning of this undertaking. The relevant principles which govern the construction of a 
restraint of trade clause, or undertaking in such terms are those applied in Barrett v Echo Personnel Pty Ltd (24 
November 1998, Court of Appeal, unreported) where Stein JA, delivering the principal judgment of the Court, 
said: 


“The appellant’s submission amounts to this. One should construe ‘solicit’ in the agreement in a highly 

mechanical fashion. You simply ask, who made the first approach? If an old customer made the first approach to 

a former employee, then whatever the facts thereafter which might lead to business being done, there cannot be 

solicitation. This cannot be correct. One may acknowledge that in most instances the first approach will be made 
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by the ex-employee to the former customer. Commonsense however demands that this not be the exclusive 
means by which a solicitation may occur. A simple illustration will suffice as to why this is so. Assume a 
customer finds out, quite accidentally, that a former employee with whom it dealt had left his principal and 
established a business of his own and says ‘let us have a proposal’. The ex-employee then submits a proposal in 
very favourable terms and makes a presentation to the client which convinces it to award the contract to him. 
Should the fact of the first approach negative any solicitation or enticing away? | think not.” 


71 One of the meanings of approach in the Macquarie Dictionary is “to make a proposal to”. The appellant 
certainly did this in relation to RIC in the emails of 10 September 2003 and by necessary inference he did so to 
the other customers with whom he had the contacts proved in evidence. The challenge to the conviction for 
breach of the second undertaking also fails. 


72 The submission that News Ltd was not a customer of the company was without substance. This was a pure 
question of fact and the Judge accepted the evidence of Mr Ryan on the point and was entitled to do so. 


73 The appeal therefore fails on all grounds and must be dismissed with costs. 


74 HODGSON JA: | agree with the orders proposed by Handley JA and with his reasons. | would add some 
short comments. 


75 Had the appellant wished to make out a substantial case that the disputed email, alone of the emails 
purportedly sent by him on 10 September 2003, was not and indeed could not have been sent by him, one would 
have expected evidence that the disputed email was sent by a different path from the admitted emails. There 
was no such evidence. 


76 In his affidavit of 14 October 2004, the appellant said that the email purportedly sent at 11.16am on 10 
September 2003 was a response to a question from its recipient: he did not deny sending it on that day, and he 
did not explicitly deny doing so in the affidavits read before this Court. That email itself was a plain breach of the 
undertaking not to approach customers, and neither the proposed fresh evidence nor the other arguments on 
appeal make out any case to the contrary. 


77 | agree with Handley JA that the proposed fresh evidence lacked the necessary credibility and materiality, 
particularly in circumstances where it depended in essential respects on the appellant’s own credibility, which 
was strongly under challenge. 


78 HUNT AJA: | agree with Handley JA. 
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